My Service Account Key Got Blocked By an Org Policy I Didn't Know Existed
The error didn't even try to be helpful: FAILED_PRECONDITION: Key creation is not allowed on this service account. No link, no suggestion, no explanation of which policy was doing this or why. I'd asked Google Cloud for a JSON key file for a brand-new service account on a brand-new project I owned outright, and it said no. This is the story of the two hours I spent trying to fight that, and the…
The error message "FAILED_PRECONDITION: Key creation is not allowed on this service account" provided no helpful information. The reporter had requested a JSON key file for a brand-new service account on a brand-new project, but Google Cloud refused to generate it. This occurred because an organization policy constraint called "iam.disableServiceAccountKeyCreation" was enabled by default and blocked key creation across every project underneath it.
The reporter tried to turn the constraint off but found that they needed the "orgpolicy.policyAdmins" role at the organization or folder level to do so, which they did not have. After realizing they didn't actually need a service account key, they discovered that OAuth's "installed-app" flow allowed them to authenticate without a human present and sidestepped the org policy.
They provided Python code to implement this flow, which behaved similarly to the service account key but did not touch the blocking constraint. The takeaway is that OAuth might be preferable to service accounts for scripts running under your own identity, as it avoids service account key restrictions imposed by organization policies.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
